CVE-2026-19843 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor
An attacker with delegated privileges can inject shell commands via a malicious LDAP DN, leading to root code execution when an admin views the entry in the Cockpit console.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-19843?
CVE-2026-19843 is a high-severity command injection vulnerability in Red Hat Directory Server 11, published on 7 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.
Weakness: CWE-78
Which versions are affected by CVE-2026-19843?
Linux distribution packages (8)
389-ds-base Red Hat:directory_server:12.8::el9 | All versions | 0:2.8.0-7.module+el9dsrv+24844+8988a132 |
cockpit-389-ds Red Hat:directory_server:12.8::el9 | All versions | 0:2.8.0-7.module+el9dsrv+24844+8988a132 |
389-ds-base Red Hat:directory_server:13.2::el10 | All versions | 0:3.2.0-7.el10dsrv |
cockpit-389-ds Red Hat:directory_server:13.2::el10 | All versions | 0:3.2.0-7.el10dsrv |
389-ds-base Red Hat:directory_server_e2s:13.0::el10 | All versions | 0:3.0.6-4.el10dsrv |
cockpit-389-ds Red Hat:directory_server_e2s:13.0::el10 | All versions | 0:3.0.6-4.el10dsrv |
389-ds-base Red Hat:directory_server_eus:12.6::el9 | All versions | 0:2.6.1-4.module+el9dsrv+24810+65883465 |
cockpit-389-ds Red Hat:directory_server_eus:12.6::el9 | All versions | 0:2.6.1-4.module+el9dsrv+24810+65883465 |
How do I fix CVE-2026-19843?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-19843 being exploited?
There is no known exploitation of CVE-2026-19843 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as AZL-99986, DEBIAN-CVE-2026-19843, GHSA-p34m-7cj2-q64p, RHSA-2026:64768, RHSA-2026:64769, RHSA-2026:64782 and 2 more.